1

Enclosure 5c

Probabilistic Risk Evaluation

2

Contents 1.0 Introduction ........................................................................................................................ 3

2.0 Risk Insights from Previous Analyses ................................................................................ 3

2.1 Individual Plant Examinations ......................................................................................... 4

2.2 Integrated Leak Rate Test Extensions ........................................................................... 5

2.3 Severe Accident Management Alternatives .................................................................... 6

3.0 Technical Approach ........................................................................................................... 7

3.1 Assumptions ................................................................................................................... 9

3.2 Delineation of Accident Sequences .............................................................................. 10

3.2.1 List of Top Events .................................................................................................. 11

3.2.2 List of Sequences .................................................................................................. 12

3.2.3 Mapping Sequences to MELCOR/MACCS2 Calculations ..................................... 15

3.2.4 Quantitative Information ........................................................................................ 16

4.0 Results ............................................................................................................................. 18

5.0 Conclusions ...................................................................................................................... 26

3

1.0 Introduction A risk evaluation was performed to estimate the reduction in risk resulting from the installation of a severe accident (SA) venting system in a boiling water reactor (BWR) with either a Mark I or Mark II containment design. This information provides a major input to the regulatory and backfit analyses of the SA venting system. In addition, the risk evaluation discusses accident sequences where the inclusion of filters to the SA venting system is and is not beneficial, as directed by the Commission in an SRM (M120807B) issued on August 24, 2012 following a staff briefing held August 7, 2012 on the status of actions taken in response to lesson learned from the Fukushima Dai-ichi accident. The purpose of a SA venting system is to prevent an uncontrolled large release of radioactive material during a severe accident as a result of containment failure due to overpressurization from the build up of steam and non-condensable gases generated during core degradation. A SA venting system should significantly reduce the amount of radioactive material released from the containment when compared to an uncontrolled release. A SA venting system is different than the reliable, hardened venting system mandated by Order EA-12-050, as shown in Table 1:

Table 1. Differences Between a Severe Accident Venting System

and a Reliable Hardened Venting System

Characteristic

Severe Accident

Venting System

Reliable Hardened

Venting System

Purpose Prevent containment overpressurization failure after core damage

Provide a pathway for decay heat removal in order to prevent core damage

Period of Use After core damage Prior to core damage

Vented Materials Radioactive steam and non-condensable gases resulting from core damage

Mildly radioactive steam (limited to activity contained in the reactor coolant system that exists during normal operations)

Release of Radioactive Materials to the Environment

Small if the severe accident venting system operates as designed to prevent containment overpressurization failure, includes a filter or other means to scrub fission products, and other containment failure modes (such as liner melt-through) are prevented

Otherwise, potentially large

Very small if the reliable, hardened vent operates as designed to prevent core damage

The following sections discuss risk insights related to SA venting obtained from previous analyses, explain the technical approach used, list the assumptions used, describe the delineation of post-core-damage accident sequences pertaining to SA venting, provide the quantitative information used, and present the results of the risk evaluation.

2.0 Risk Insights from Previous Analyses

4

As an initial step in the risk evaluation, the staff reviewed information from the individual plant examinations completed in response to Generic Letter 88-20, license amendment requests for integrated leak rate testing (ILRT) extensions, and severe accident mitigation alternatives (SAMA) analyses submitted with license renewal requests. The purpose of this review was to gain insight into the causes and likelihood of containment failure and to understand how SA venting has been considered in previous PRAs and risk-informed applications. The following sections summarize the information obtained.

2.1 Individual Plant Examinations The results of individual plant examinations (IPEs) indicated that the likelihood of Mark I and Mark II containment failure due to severe accident phenomena is not insignificant. Figure 1 illustrates the range of conditional containment failure probabilities for BWR Mark I containments as reported in the IPEs submittals.

Figure 1. Reported IPE Conditional Probabilities of Failure for BWR Mark I Containments With respect to the likelihood of BWR Mark I containment failure modes, NUREG-1560 indicates that liner melt-through is the most important contributor to early containment failure. Overpressurization failures are generally associated with late containment failure, as discussed in NUREG-1560:

Because of a high containment pressure capability and the energy absorbing capacity of the suppression pool, a typical Mark I containment is unlikely to fail because of overpressure early in the accident sequence. However, accidents in which both containment heat removal and containment venting are not available

Source: NUREG-1560, Figure 12.7

5

or inadequate (such as occurs in some sequences in which the reactor vessel fails at high pressure, or in some anticipated transient without scram (ATWS) sequences) can cause early containment failure. For these sequences, containment may fail either before or at vessel breach because of the high containment pressures.

As noted in Table 10.4 of NUREG-1560, the design pressures for BWR Mark I containments range from 56 to 62 psig, and the median failure pressures estimated for the IPEs range from 98 to 190 psig. Figure 2 illustrates the range of conditional containment failure probabilities for BWR Mark II containments as reported in the IPE submittals.

Figure 2. Reported IPE Conditional Probabilities of Failure for BWR Mark II Containments NUREG-1560 states that containment overpressure failure caused by a loss of containment heat removal (primarily during ATWS sequences) is important in most Mark II IPE analyses, and that rapid pressure and temperature increases at the time of reactor vessel failure are significant in only a few Mark II IPE analyses. Specific plant features play an important role in accident progression in Mark II containments. As noted in Table 10.4 of NUREG-1560, the design pressures for BWR Mark II containments range from 45 to 55 psig, and the median failure pressures estimated for the IPEs range from 140 to 191 psig.

2.2 Integrated Leak Rate Test Extensions In recent years, a number of BWR Mark I and Mark II plants have applied for and been granted extensions of their ILRT intervals. ILRTs are conducted to satisfy the requirements of 10 CFR

Source: NUREG-1560, Figure 12.11

6

Part 50, Appendix J, “Primary Reactor Containment Leakage Testing for Water-Cooled Power Reactors.” Relevant to SA venting, license amendments requests for ILRT extension provide information that can be used to estimate conditional containment failure probabilities. A review of this information was made to determine how licensees’ understanding of conditional containment failure probability has evolved since completion of their IPEs. Table 2 summarizes the contributions to conditional containment failure probability for selected ILRT extension requests. Note that the contributions to conditional containment failure probability by specific accident-induced failures (overpressurization, liner melt-through, etc.) are not provided in ILRT extension requests.

Table 2. Conditional Containment Failure Probabilities from ILRT Extensions

Plant Type ILRT Interval Accident

Phenomena

Bypass

(ISLOCA) Isolation Failures

Total

CCFP

Cooper Mark I 3 in 10y

1 in 10y

1 in 15y

94.6%

94.6%

94.6%

0.0%

0.0%

0.0%

1.0%

1.0%

1.0%

95.6%

95.6%

95.6%

Nine Mile Point 1 Mark I 3 in 10y

1 in 10y

1 in 15y

62.4%

62.4%

62.4%

2.7%

2.7%

2.7%

9.7%

9.7%

9.8%

74.8%

74.9%

74.9%

Peach Bottom Mark I 3 in 10y

1 in 10y

1 in 15y

61.1%

61.1%

61.1%

2.4%

2.4%

2.4%

2.7%

3.4%

4.0%

66.2%

67.0%

67.5%

Pilgrim Mark I 3 in 10y

1 in 10y

1 in 15y

97.7%

97.7%

97.7%

0.6%

0.6%

0.6%

0.0%

0.1%

0.1%

98.3%

98.3%

98.4%

Vermont Yankee Mark I 1 in 10y

1 in 15y

86.8%

86.8%

1.1%

1.1%

0.1%

0.2%

88.0%

88.1%

LaSalle Mark II 3 in 10y

1 in 10y

1 in 15y

82.9%

82.9%

82.9%

2.4%

2.4%

2.4%

0.4%

0.6%

0.8%

85.7%

85.9%

86.1%

Limerick Mark II 3 in 10y

1 in 10y

1 in 15y

62.4%

62.4%

62.4%

1.3%

1.3%

1.3%

0.7%

1.5%

2.0%

64.4%

65.2%

65.7%

2.3 Severe Accident Management Alternatives Table 3 provides a breakdown by plant type of how filtered containment vent (FCV) systems have been considered in SAMA analyses. SAMA analyses have used two approaches when considering FCV systems. A screening approach compares the cost of a FCV system to the monetized baseline risk of the plant. This approach is conservative since it assumes that installation of a FCV system will completely eliminate all plant risk. A detailed approach attempts to approximate the risk reduction that would be achieved by installing a FCV system by adjusting the source terms that are used in a Level 3 PRA. Three early SAMA analyses stated

7

that they had considered FCV systems, but the discussion does not describe the approach taken to assess the risk reduction or provide the numerical results. To date, no SAMA analysis has determined that FCV systems are cost justified.

Table 3. Consideration of Filtered SA Venting in SAMA Analyses, as of February 2012

Plant Type FCV Not

Considered

FCV Considered (Screening Analysis)

FCV Considered

(Detailed Analysis)

License Renewal

Granted, but Limited SAMA

License Renewal

Application Not

Submitted Total

BWR Mark I 5 11 5 1 1 23

BWR Mark II 1 3 2 2 8

BWR Mark III 1 3 4

PER large dry containment

22 10 14 9 55

PWR subatmospheric containment

5 5

PWR ice condenser

2 4 3 9

Totals 28 26 29 3 18 104

3.0 Technical Approach The addition of an SA venting system does not change a plant’s core-damage frequency (CDF); rather, it affects the frequency of releases to the environment resulting from core damage and also the consequences of these releases. Release frequencies are estimated using Level 2 PRA methods, and consequences are estimated using Level 3 PRA methods. The staff has developed three proof-of-concept Level 2 Standardized Plant Analysis of Risk (SPAR) models, but does not routinely use them to support regulatory decisionmaking. In addition, the staff does not have any Level 3 PRA models. As a result, a simplified event tree was constructed to estimate the frequencies of the MELCOR scenarios developed to support the assessment of SA venting, as described in Enclosure 5a. Coupled with the MACCS2 consequence results, described in Enclosure 5b, developed for each MELCOR scenario, this simplified event tree provides the information needed to assess the reduction in risk resulting from the installation of an SA venting system. There are a variety of ways to design an SA venting system, depending on where the vent attached (wetwell or drywell), how the vent is actuated (manually by the operator or passively using a rupture disk), and whether the SA venting system has a filter. The simplified event tree structure used to estimate release sequence frequencies was designed to allow assessment of a wide range of SA vent system designs. Specifically, the same simplified event tree structure was used to assess nine hypothetical plant modifications (“mods”), which are defined in Table 4.

8

Table 4. Hypothetical Plant Modifications Assessed in the Risk Evaluation

Plant Modification Identifier SA Vent Filter SA Vent Location SA Vent Actuation

Mod 0

(current situation)

n/a None n/a

Mod 1 No Wetwell Manual

Mod 2 No Wetwell Passive

Mod 3 No Drywell Manual

Mod 4 No Drywell Passive

Mod 5 Yes Wetwell Manual

Mod 6 Yes Wetwell Passive

Mod 7 Yes Drywell Manual

Mod 8 Yes Drywell Passive

The first two characteristics that define the plant modification (the presence of a filter and the vent location) only affect the consequences associated with the release sequences defined in the simplified event tree. For example, the addition of a filter or venting through the wetwell would reduce the consequences. The third characteristic (vent actuation method) only affects the frequency of the release sequences. For example, utilization of a passive mechanism (e.g., rupture disk) to actuate the vent path is expected to be more reliable than operator action, and therefore, the frequency of large releases is expected to decrease more when a passive vent is used than when relying on manual operation. In order to support the regulatory and backfit analyses, the following risk metrics were estimated for each hypothetical plant modification: • 50-mile population does risk (person-rem/reactor-year) • 50-mile offsite cost risk ($/reactor-year) • Onsite worker dose risk (person-rem/reactor-year) • Onsite cleanup and decontamination cost ($/reactor-year) Using the risk metrics identified above, the risk reductions (relative to Mod 0, which is the current situation) due to implementation of each hypothetical plant modification (Mod 1 through Mod 8) were estimated. These risk reductions are used as an input to the regulatory and backfit analyses:

• Reduction in 50-mile population dose risk (Δperson-rem/reactor-year)

• Reduction 50-mile offsite cost risk (Δ$/reactor-year)

• Reduction in onsite worker dose risk (Δperson-rem/reactor-year)

• Reduction in onsite cleanup and decontamination cost (Δ$/reactor-year)

9

In addition to the risk metrics listed above, a risk metric pertaining to land contamination was estimated. It should be noted that the impact of accident releases on land contamination that occurs within 50 miles of the site is included in the offsite cost risk. A direct measure of land contamination risk (including contaminated land that is farther than 50 miles from the site) is desirable to gain perspective on the risk reductions that can be achieved through implementation of the hypothetical plant modifications. Mathematically, risk is defined as the sum of the product of the release sequence frequency and the consequence of the release:

where R denotes the risk, fi denotes the frequency of the i th release sequence, and ci denotes the consequences associated with the i th release sequence, and the summation is taken over all release sequences. One measure of the consequences of a release with respect to land

contamination is the amount of area (in km2) that is contaminated above 15 μCi/m2 with cesium-137 (137Cs)1. Using this consequence measure, land contamination risk has the units of km2/ry, which is rather difficult to interpret. A potentially more insightful risk metric is conditional contaminated land area (CCLA), as defined by: ∑∑

That is, the CCLA is the frequency-weighted average area contaminated above 15 μCi/m2 with 137Cs, conditional on the occurrence of a core-damage accident. Accordingly, a reduction in CCLA due to implementation of one of the hypothetical SA vent modifications measures the effectiveness of that modification with respect to reducing land contamination.

3.1 Assumptions The following assumptions were used to conduct the risk evaluation: 1. The existing regulatory analysis guidance provided in NUREG/BR-0058, “Regulatory

Analysis Guidelines of the U.S. Nuclear Regulatory Commission,” and NUREG/BR-0184, “Regulatory Analysis Technical Evaluation Handbook” have been used. Accordingly: a. The risk evaluation was developed on a “per-reactor” basis b. Multi-unit accidents were not addressed c. Accidents involving spent fuel (stored either in the spent fuel pool or in dry casks)

were not addressed

1 Annex I to IAEA TECDOC-1240, “Present and future environmental impact of the Chernobyl accident,” zoned land surrounding the Chernobyl site according to the level of radionuclide soil deposition. Land that was contaminated above 15 μCi/m2 with 137Cs was called an “obligatory (subsequent) resettlement zone.” Permanent residence and the production of commodities within the obligatory (subsequent) resettlement zone is forbidden.

10

2. Except for bypass sequences (ISLOCAs and large external hazards that directly fail the

containment), severe accident containment venting is always required to prevent a containment overpressurization failure. This assumption follows from the results of the MELCOR calculations performed to support the regulatory and backfit analyses of SA venting.

3. No credit was given for recovering offsite power if core damage was caused by an external hazard (seismic event, high winds, etc.).

4. The consequences of accident sequence that result in radioactive releases are

reasonably approximated by determining the consequences of station blackout (SBO) sequences.

5. The reactor core isolation cooling (RCIC) system operates for 16 hours (16-hour battery

depletion).

6. If the SA venting system includes a filter, then it has a decontamination factor of 10 (wetwell venting) or 1,000 (drywell venting)..

7. If an accident sequence involves failure to open the SA vent or containment bypass (such as an interfacing system loss-of-coolant accident (ISLOCA)), then use of a portable pump to provide core spray or drywell spray following core damage is precluded due to a harsh work environment (high dose rates, high temperatures, etc.).

3.2 Delineation of Accident Sequences The simplified release event tree (Figure 3) traces the accident progression starting from the onset of core damage. The initial event tree headings parse the total CDF according to the type of initiating event and core-damage sequence. Subsequent event tree headings consider operation of the SA vent and the availability of a water supply to the drywell. Each sequence has been assigned to a unique containment status: • Vented: The SA vent is opened, preventing containment overpressurization failure. A

source of water to the drywell exists, preventing liner melt-through.

• LMT: The SA vent is opened, preventing containment overpressurization failure. No source of water to the drywell exists, and liner melt-through occurs.

• OP: The SA vent is closed, resulting in containment overpressurization failure. A source of water to the drywell exists, preventing liner melt-through.

• OP + LMT: The SA vent is closed, resulting in containment overpressurization failure. No source of water to the drywell exists, and liner melt-through occurs.

3.2.1 L The releathe follow • E

tha

• Ehseof

• Ein

List of Top E

ase event trewing sections

Event “CD:” he risk evalure directly p

Event “hazardazard type; eismic evenffsite power

Event “sequenfluence on c

o Seque“bypa

o Sequeblackoallowswater

Figur

Events

ee consists os.

Represents uation. It shoroportional t

d:” Partitioneither internt). This partis recoverab

ence type:” Pcontainment

ence “other”ss,” or “fast.ence type “Sout. In theses the use of to the conta

re 3. Simplif

of six event

the occurreould be noteto the core-d

ns core-damanal hazards (titioning is inble.

Partitions cot integrity. F

denotes the”

SBO” denotee sequencesin-plant syst

ainment dryw

11

fied Release

tree heading

nce of core ed that the risdamage freq

age sequenc(such as a Lncluded in th

ore-damage For internal h

e internal ha

es core-dams, it may be tems (such awell.

e Event Tree

gs (top even

damage, whsks resultinguency.

ces accordinLOCA) or exthe event tree

sequences hazards:

azard sequen

age sequenpossible to ras condensa

e.

nts), which a

hich is the stg from radiol

ng to their internal hazarde structure to

according to

nces that are

ces that invorecover offsiate) to provid

re described

tarting point logical relea

nitiating evends (such as o determine

o their timing

e not “SBO,”

olves stationite power, wde a source

d in

of ses

nt a if

g or

”

n which

of

12

o Sequence type “bypass” denotes core-damage sequences that involve containment bypass (such as ISLOCAs). In these sequences, venting the containment is not helpful because the containment has already functionally failed.

o Sequence type “fast” denotes sequences that evolve quickly (such as medium LOCAs, large LOCAS, and anticipated transients without scram (ATWS)) and, thus, reduce the available time for the operator to manually open the SA vent.

For external hazards:

o Sequence “other” denotes the external hazard sequences that are not “bypass.” o Sequence type “bypass” denotes core-damage sequences that involve

containment bypass (such as large seismic events that directly damage the containment). In these sequences, venting the containment is not helpful because the containment has already functionally failed.

• Event “vent:” Identifies if the SA vent is opened.

• Event “OSP recovery:” Identifies if offsite power is recovered.

• Event “portable pump:” Identifies if a portable pump is used to provide water to the

drywell floor via the core spray system or drywell spray system following core damage.

3.2.2 List of Sequences The release event tree delineates 16 post-core-damage accident sequences, which are summarized in the following paragraphs. • Sequence 1 (status “vented”): Following core damage caused by an internally initiated

sequence that does not involve SBO, ISLOCAs, or quickly developing sequences (e.g., MLOCA, LLOCA, or ATWS), the SA vent is opened, thereby preventing containment overpressurization failure. In-plant equipment (such as the emergency core cooling system (ECCS)) is assumed to be unavailable (if it was available, core damage would not have occurred in the first place). However, a portable pump is successfully installed and operated to provide water to the drywell floor, thereby preventing liner melt-through.

• Sequence 2 (status “LMT”): Following core damage caused by an internally initiated

sequence that does not involve SBO, ISLOCAs, or quickly developing sequences (e.g., MLOCA, LLOCA, or ATWS), the SA vent is opened, thereby preventing containment overpressurization failure. In-plant equipment (such as the ECCS) is assumed to be unavailable (if it was available, core damage would not have occurred in the first place). Moreover, a portable pump to provide water to the drywell floor is either not installed or fails. As a result, liner melt-through occurs.

13

• Sequence 3 (status “OP + LMT”): Following core damage caused by an internally initiated sequence that does not involve SBO, ISLOCAs, or quickly developing sequences (e.g., MLOCA, LLOCA, or ATWS), the SA vent remains closed and the containment fails due to overpressurization. In-plant equipment (such as the ECCS) is assumed to be unavailable (if it was available, core damage would not have occurred in the first place). Moreover, use of a portable pump to provide water to the drywell floor is precluded since the operator cannot access areas of the plant needed to install the pump and associated equipment. As a result, liner melt-through occurs.

• Sequence 4 (status “vented”): Following core damage caused by an internally initiated

SBO sequence, the SA vent is opened, thereby preventing containment overpressurization failure. Offsite power is recovered, which allows the use of in-plant equipment (such as the condensate system) to provide water to the drywell floor and avoid liner melt-through.

• Sequence 5 (status “vented”): Following core damage caused by an internally initiated

SBO sequence, the SA vent is opened, thereby preventing containment overpressurization failure. Offsite power is not recovered, which prevents the use of in-plant equipment to provide water to the drywell floor. However, a portable pump is successfully installed and operated to provide water to the drywell floor, thereby preventing liner melt-through.

• Sequence 6 (status “LMT”): Following core damage caused by an internally initiated SBO sequence, the SA vent is opened, thereby preventing containment overpressurization failure. Offsite power is not recovered, which prevents the use of in-plant equipment to provide water to the drywell floor. Moreover, a portable pump to provide water to the drywell floor is either not installed or fails. As a result, liner melt-through occurs.

• Sequence 7 (status “OP”): Following core damage caused by an internally initiated SBO

sequence, the SA vent remains closed and the containment fails due to overpressurization. Offsite power is recovered, which allows the use of in-plant equipment (such as the condensate system) to provide water to the drywell floor and avoid liner melt-through.

• Sequence 8 (status “OP + LMT”): Following core damage caused by an internally

initiated SBO sequence, the SA vent remains closed and the containment fails due to overpressurization. Offsite power is not recovered, which prevents the use of in-plant equipment to provide water to the drywell floor. Moreover, use of a portable pump to provide water to the drywell floor is precluded since the operator cannot access areas of the plant needed to install the pump and associated equipment. As a result, liner melt-through also occurs.

14

• Sequence 9 (status “OP + LMT”): Core damage occurs due to an internally initiated ISLOCA sequence. Venting the containment is not necessary because overpressurization cannot occur (the steam and non-condensable gases caused by core degradation pass through the ISLOCA and, hence, bypass the containment). The risk evaluation assumes that the consequences resulting from containment bypass are the same as the consequences resulting from containment overpressurization, followed by liner melt-through. Moreover, use of a portable pump to provide water to the drywell floor is precluded since the operator cannot access areas of the plant needed to install the pump and associated equipment. As a result, liner melt-through also occurs.

• Sequence 10 (status “vented”): Following core damage caused by an internally initiated, quickly developing sequences (e.g., MLOCA, LLOCA, or ATWS), the SA vent is opened, thereby preventing containment overpressurization failure. In-plant equipment (such as the ECCS) is assumed to be unavailable due to equipment failure or a nonrecoverable loss of offsite power (if it was available, core damage would not have occurred in the first place). However, a portable pump is successfully installed and operated to provide water to the drywell floor, thereby preventing liner melt-through. This sequence is similar to Sequence 1; however, there is less available time to open the SA vent.

• Sequence 11 (status “LMT”): Following core damage caused by an internally initiated,

quickly developing sequences (e.g., MLOCA, LLOCA, or ATWS), the SA vent is opened, thereby preventing containment overpressurization failure. In-plant equipment (such as the ECCS) is assumed to be unavailable due to equipment failure or a nonrecoverable loss of offsite power (if it was available, core damage would not have occurred in the first place). Moreover, a portable pump to provide water to the drywell floor is either not installed or fails. As a result, liner melt-through occurs. This sequence is similar to Sequence 2; however, there is less available time to open the SA vent.

• Sequence 12 (status “OP + LMT”): Following core damage caused by an internally

initiated, quickly developing sequences (e.g., MLOCA, LLOCA, or ATWS), the SA vent remains closed and the containment fails due to overpressurization. In-plant equipment (such as the ECCS) is assumed to be unavailable (if it was available, core damage would not have occurred in the first place). Moreover, use of a portable pump to provide water to the drywell floor is precluded since the operator cannot access areas of the plant needed to install the pump and associated equipment. As a result, liner melt-through also occurs. This sequence is similar to Sequence 3; however, there is less available time to open the SA vent.

• Sequence 13 (status “vented”): Following core damage caused by an externally initiated

sequence that does not involve containment bypass, the SA vent is opened, thereby preventing containment overpressurization failure. In-plant equipment (such as the ECCS) is assumed to be unavailable (if it was available, core damage would not have occurred in the first place). However, a portable pump is successfully installed and operated to provide water to the drywell floor, thereby preventing liner melt-through.

15

This sequence is similar to Sequence 1; however, it is an external hazard sequence rather than an internal hazard sequence.

• Sequence 14 (status “LMT”): Following core damage caused by an externally initiated

sequence that does not involve containment bypass, the SA vent is opened, thereby preventing containment overpressurization failure. In-plant equipment (such as the ECCS) is assumed to be unavailable due to equipment failure or a nonrecoverable loss of offsite power (if it was available, core damage would not have occurred in the first place). Moreover, a portable pump to provide water to the drywell floor is either not installed or fails. As a result, liner melt-through occurs. This sequence is similar to Sequence 2; however, it is an external hazard sequence rather than an internal hazard sequence.

• Sequence 15 (status “OP + LMT”): Following core damage caused by an externally

initiated sequence that does not involve containment bypass, the SA vent remains closed and the containment fails due to overpressurization. In-plant equipment (such as the ECCS) is assumed to be unavailable (if it was available, core damage would not have occurred in the first place). Moreover, use of a portable pump to provide water to the drywell floor is precluded since the operator cannot access areas of the plant needed to install the pump and associated equipment. As a result, liner melt-through also occurs. This sequence is similar to Sequence 3; however, it is an external hazard sequence rather than an internal hazard sequence.

• Sequence 16 (status “OP + LMT”): Core damage occurs due to an externally initiated

sequence that involves containment bypass. Venting the containment is not necessary because overpressurization cannot occur (the steam and non-condensable gases caused by core degradation bypass the containment). The risk evaluation assumes that the consequences resulting from containment bypass are the same as the consequences resulting from containment overpressurization, followed by liner melt-through. Moreover, use of a portable pump to provide water to the drywell floor is precluded since the operator cannot access areas of the plant needed to install the pump and associated equipment. As a result, liner melt-through also occurs. This sequence is similar to Sequence 9; however, it is an external hazard sequence rather than an internal hazard sequence.

3.2.3 Mapping Sequences to MELCOR/MACCS2 Calculations As previously discussed, each sequence in the simplified release event tree has been assigned to a unique containment status. This mapping has been used, along with the definitions of the hypothetical plant modifications, to determine the specific MELCOR/MACCS2 (Enclosures 5a and 5b) calculation that applies to each sequence as shown in Table 5.

16

Table 5. Mapping to Release Sequences to MELCOR/MACCS2 Calculations

Modification Description Release Sequence Status

Mod Filter Location Actuation Vented

• Vent: open • DW: wet • Seq: 1, 4, 5,

10, and 13

LMT

• Vent: open • DW: dry • Seq: 2, 6, 11,

and 14

OP

• Vent: closed • DW: wet • Seq: 7

OP + LMT

• Vent: closed • DW: dry • Seq: 3, 8, 9,

12, 15, and 16

0 n/a n/a None n/a n/a Case 6 Case 2

1 No Wetwell Manual Case 7 or 15

(no filter)

Case 3

(no filter) Case 6 Case 2

2 No Wetwell Passive

3 No Drywell Manual Case 13

(no filter)

Case 12

(no filter) Case 14 Case 2

4 No Drywell Passive

5 Yes Wetwell Manual Case 7 or 15

(filter)

Case 3

(filter) Case 6 Case 2

6 Yes Wetwell Passive

7 Yes Drywell Manual Case 13

(filter)

Case 12

(filter) Case 14 Case 2

8 Yes Drywell Passive

3.2.4 Quantitative Information Parameters values used to estimate the release sequence frequencies were taken from a variety of sources, as shown in Table 6.

Table 6. Parameter Values Used in the Risk Evaluation

Parameter Value Basis

CDF 2E-5/reactor-year SPAR external hazard models

Fraction of total CDF due to external hazards

0.8 SPAR external hazard models; review of previous PRAs

Breakdown of sequence types for internal hazards

Other (not SBO, bypass or fast) 0.83 SPAR internal hazard models

SBO 0.12

Bypass (ISLOCAs) 0.05

Fast (MLOCAs, LLOCAs, ATWS) 0.01

Breakdown of sequence types for external hazards

Other (not bypass) 0.95 Review of previous PRAs; engineering judgment

Bypass 0.05

Probability that SA vent fails to open Mod 0 1

Mods 1, 3, 5, 7 – other or SBO 0.3 SPAR-H method (manual vent; longer available time)

Mods 1, 3, 5, 7 – fast 0.5 SPAR-H method (manual vent; shorter available time)

Mods 2, 4, 6, 8 0.001 Engineering judgment (passive vent mechanical failure)

17

Table 6. Parameter Values Used in the Risk Evaluation

Parameter Value Basis

Conditional probability that offsite power is not recovered by the time of lower head failure given not recovered at the time of core damage (internal hazards)

0.38 Historical data (NUREG-6890)

Probability that portable pump for core spray or drywell spray fails

0.3 SPAR-H; consistent with SPAR B.5.b study done by Idaho National Laboratory

The consequence per release for population dose, offsite cost, and contaminated area were obtained from MELCOR/MACCS2 calculations (Enclosures 5a and 5b). Table 7 lists the results of these calculations which have been used in the risk evaluation.

Table 7. Consequences Determined by MELCOR/MACCS2 Calculations

Case Core Spray

Drywell Spray Venting Location

Population Dose (person-

rem/event) Offsite Cost

($/event)

Land Contamination

(km2/event)

2 no no no n/a 514,000 $1,910,000,000 354

3F no no yes wetwell 183,000 $274,000,000 8

3NF no no yes wetwell 397,000 $1,730,000,000 54

6 yes no no n/a 305,000 $847,000,000 91

7F yes no yes wetwell 37,300 $17,600,000 0.4

7NF yes no yes wetwell 235,000 $484,000,000 34

12F no no yes drywell 232,000 $391,000,000 28

12NF no no yes drywell 3,810,000 $33,300,000,000 9,150

13F no yes yes drywell 59,990 $37,700,000 2

13NF no yes yes drywell 3,860,000 $33,000,000,000 8,830

14 no yes no n/a 86,100 $116,000,000 12

15F no yes yes wetwell 43,300 $20,200,000 0.3

15NF no yes yes wetwell 280,000 $588,000,000 28

Table 8 lists the onsite consequences that were used in the risk evaluation, consistent with the existing regulatory analysis guidance in NUREG/BR-0184.

Table 8. Onsite Consequences

Release End State

Onsite Worker Dose Risk

(person-rem/event)

Onsite Cost

($/event)

vented - filtered 1,000 $1,900,000,000

vented - unfiltered 3,300 $2,390,000,000

LMT, OP, or OP + LMT 14,000 $3,190,000,000

18

4.0 Results Table 9 provides the frequencies and percent contributions for each end state defined in the risk evaluation. The frequencies and contributions are identical for those modifications that have the same vent actuation method (either manual or passive). This is expected since the venting actuation method (and its associated failure probability) is the only characteristic among the group of characteristics that define the hypothetical plant modifications which influences the event tree sequence frequencies. Comparison of the information in this table to the CCFP values presented in Table 2 demonstrates that the installation of an SA venting system helps to lower the CCFP.

Table 9. Breakdown of Containment Failure Modes

Mod Vent

Filtered

Vent

Location Vent

Actuation

End State

vent LMT OP LMT + OP

0 n/a None n/a 0

0%

0

0%

3E-7

1.5%

2E-5

98.5%

1 No Wetwell Manual

9E-6

46.8%

4E-6

19.6%

9E-8

0.4%

7E-6

33.1%

3 No Drywell Manual

5 Yes Wetwell Manual

7 Yes Drywell Manual

2 No Wetwell Passive

1E-5

66.9%

6E-6

28.0%

3E-10

0.0%

1E-6

5.1%

4 No Drywell Passive

6 Yes Wetwell Passive

8 Yes Drywell Passive

Table 10 provides the point estimates of the risks for each of the nine hypothetical plant modifications (Mod 0, which is the current situation and Mods1 through 8). In comparison to Mod 0, in the available SAMA analyses, the baseline 50-mile population dose risks range from 3.3 to144 person-rem/ry, and the offsite cost risks range from $5,614/ry to $976,847/ry.

Table 10. Risk Evaluation Results (Point Estimates)

Mod Vent

Filtered

Vent

Location Vent

Actuation

50-mile Population Dose Risk (person-rem/ry)

50-mile Offsite

Cost Risk ($/ry)

Onsite Worker

Dose Risk (person-rem/ry)

Onsite Cost risk

($/ry) CCLA (km2)

0 n/a None n/a 10.2 $37,884 0.28 $63,800 350.1

1 No Wetwell Manual 7.2 $24,041 0.14 $53,166 144.1

2 No Wetwell Passive 5.9 $18,117 0.08 $48,615 55.9

3 No Drywell Manual 54.5 $452,466 0.14 $53,166 6,048.4

19

Table 10. Risk Evaluation Results (Point Estimates)

Mod Vent

Filtered

Vent

Location Vent

Actuation

50-mile Population Dose Risk (person-rem/ry)

50-mile Offsite

Cost Risk ($/ry)

Onsite Worker

Dose Risk (person-rem/ry)

Onsite Cost risk

($/ry) CCLA (km2)

4 No Drywell Passive 73.5 $630,000 0.08 $48,615 8,487.8

5 Yes Wetwell Manual 4.5 $13,958 0.11 $46,653 119.3

6 Yes Wetwell Passive 2.0 $3,717 0.03 $39,315 20.5

7 Yes Drywell Manual 4.9 $14,540 0.11 $46,653 123.6

8 Yes Drywell Passive 2.6 $4,642 0.03 $39,315 27.2

Table 11 provides the risk reductions (relative to Mod 0, the current situation) associated with implementation of the SA venting system plant modifications (Mods1 through 8). Figures 4 through 8 graphically depict the information contained in Table 11.

Table 11. Risk Reduction Results (Point Estimates)

Mod Vent

Filtered

Vent

Location Vent

Actuation

Reduction in 50-mile

Population Dose Risk (Δperson-

rem/ry)

Reduction in 50-mile

Offsite Cost Risk

(Δ$/ry)

Reduction in Onsite Worker

Dose Risk (Δperson-

rem/ry)

Reduction in Onsite Cost risk

(Δ$/ry)

Reduction in CCLA (Δkm2/ry)

1 No Wetwell Manual 3.0 $13,842 0.14 $10,634 206.0

2 No Wetwell Passive 4.3 $19,767 0.29 $15,185 294.2

3 No Drywell Manual -44.3 -$414,582 0.14 $10,634 -5,698.3

4 No Drywell Passive -63.3 -$592,117 0.20 $15,185 -8,137.7

5 Yes Wetwell Manual 5.7 $23,926 0.17 $17,147 230.8

6 Yes Wetwell Passive 8.2 $34,166 0.25 $24,485 329.5

7 Yes Drywell Manual 5.3 $23,344 0.17 $17,147 226.4

8 Yes Drywell Passive 7.6 $33,242 0.25 $24,485 322.9

Figure

Figu

4. Reductio

re 5. Reduc

20

on in Popula

ction in Offsi

ation Dose R

ite Cost Risk

Risk

k

Figure 6

Figu

. Reduction

re 7. Reduc

21

in Onsite W

ction in Onsi

Worker Dose

ite Cost Risk

Risk

k

In order tmodificatthe paramassigned

CDF

Fraction ofhazards

Breakdowninternal haz

Breakdownexternal ha

Probability

Fig

to gain furthetions, a simpmeters usedd a distributio

Parameter

f total CDF due

n of sequence tzards

n of sequence tazards

that SA vent fa

gure 8. Red

er insight intple parametrd to quantify on as descri

e to external

types for

types for

ails to open

uction in Co

to the risk reric Monte Cathe sequencbed in Table

Table 12. Un

2

Other (not SBO

SBO

Bypass (ISLO

Fast (MLOCAs

Other (not byp

Bypass

Mod 0

Mods 1, 3, 5, 7

22

onditional Co

eductions affarlo uncertaice frequencie 12.

certainty Dist

Mean

2E-5/reactor ye

0.8

O, bypass or fa

CAs)

s, LLOCAs, AT

pass)

7 – other or SB

ontaminated

forded by thenty analysisies and each

ributions

ear

ast) 0.83

0.12

0.05

TWS) 0.01

0.95

0.05

1

BO 0.3

Land Area

e hypothetics was performh of the cons

D

Lognormal

Beta; α = 0

3 Dirichlet

α1 (other )

α2 (SBO) =

α3 (bypass

α4 (fast ) =

2

5

5 Beta; α (by(bypass) =

5

Held const

Beta; α = 0

cal plant med. Each osequences w

Distribution

; error factor =

0.5, β = 0.125

= 41

= 6

) = 2.5

0.5

ypass) = 0.5, β9.5

tant

0.5, β = 1.167

of was

10

Conditionapower is nolower headrecovered damage (in

Probability core spray

Consequen

Results ovalues arthe 95th pconsequeuncertain

Parameter

al probability thaot recovered byd failure given nat the time of c

nternal hazards

that portable por drywell spra

nces

of the paramre very closepercentile to ence categonty in the cor

Figu

at offsite y the time of not core s)

pump for ay fails

metric uncertae, although sthe point es

ory. The mare-damage f

ure 9. Uncer

Table 12. Un

Mods 1, 3, 5, 7

Mods 2, 4, 6, 8

Per

ainty analyssomewhat hstimate varieajor contributfrequency an

rtainty in the

23

certainty Dist

Mean

7 – fast

8

0.38

0.3

Tables X-7 an

is are shownigher, to the

es from aboutors to uncernd uncertain

e Reduction

ributions

0.5

0.001

d X-8

n in Figures e point estimut 3.5 to 4.0 rtainty in thenty in the seq

in Populatio

D

Beta; α = 0

1 Beta; α = 0

Beta; α = 0

Beta; α = 0

Lognormal

Within a givcategory, cassumed todependent

9 through 1ates. In gendepending o

e risk reductiquence cons

n Dose Risk

Distribution

0.5, β = 0.5

0.5, β = 499.5

0.5, β = 0.816

0.5, β = 1.167

; error factor =

ven consequenconsequences o be totally t.

3. The meaneral, the raton the on results asequences.

k

10

nce were

an tio of

re

Fig

Figure

gure 10. Un

11. Uncerta

ncertainty in

ainty in the R

24

the Reductio

Reduction in

on in Offsite

n Onsite Wo

e Cost Risk

rker Dose RRisk

F

Fig

Figure 13. U

gure 12. Un

Uncertainty i

ncertainty in

n the Reduc

25

the Reductio

ction in Cond

on in Onsite

ditional Cont

e Cost Risk

taminated Laand Area

26

5.0 Conclusions The risk evaluation presented above, which incorporates information and insights from the MELCOR analysis in Enclosure 5a and the MACCS analysis in Enclosure 5b, makes a compelling technical argument for a strategy to mitigate the radiological consequences of severe accidents in BWR Mark I containments that includes a combination of SA venting and core debris cooling, supplemented further by the installation of an external filter. In other words, the risk evaluation provides a technical basis to support Option 3 in the regulatory analysis. The risk evaluation presented here leads to the following specific conclusions on SA venting: • The installation of an unfiltered wetwell SA venting system will reduce public health risk,

offsite economic cost risk, and land contamination risk.. In contrast, the installation of an unfiltered drywell SA venting system will increase public health risk, offsite economic cost risk, and land contamination risk.

• The installation of a filtered SA venting system (attached to either the wetwell or the

drywell) will reduce public health risk, offsite economic cost risk, and land contamination risk. That is, the incorporation of an external filter into the SA venting systems is preferable.

• By preventing containment overpressurization failure, the successful operation of a SA venting system promotes access to plant areas where portable pumps would be installed to provide core debris cooling.

• The installation of a SA venting system (unfiltered or filtered, attached to the wetwell or

the drywell) will reduce onsite worker health risk and onsite cost risk.

• Passive actuation (via a rupture disk) is preferred to manual actuation because it is more reliable and, hence, results in larger risk reductions.

• The uncertainty in the mount of risk reduction schieved by the installation of a SA venting system is mainly due to uncertainty in the core-damage frequency and uncertainty in the offsite and onsite consequences resulting from radiological releases.

Formatted: Left

Formatted: List Paragraph, Left, Indent:Hanging: 0.5", Bulleted + Level: 1 + Alignedat: 0.25" + Indent at: 0.5"

Formatted: Left, Indent: Hanging: 0.5"

Formatted: List Paragraph, Left, Indent:Hanging: 0.5", Bulleted + Level: 1 + Alignedat: 0.25" + Indent at: 0.5"

Formatted: Indent: Left: 0.5", No bullets ornumbering

Formatted: List Paragraph, Left, Indent:Hanging: 0.5", Bulleted + Level: 1 + Alignedat: 0.25" + Indent at: 0.5"

Formatted: Left, Indent: Hanging: 0.5"

Formatted: List Paragraph, Left, Indent:Hanging: 0.5", Bulleted + Level: 1 + Alignedat: 0.25" + Indent at: 0.5"

Formatted: Indent: Left: 0.5", No bullets ornumbering

Formatted: List Paragraph, Left, Indent:Hanging: 0.5", Bulleted + Level: 1 + Alignedat: 0.25" + Indent at: 0.5"

Formatted: Indent: Left: 0.5", No bullets ornumbering

Formatted: List Paragraph, Left, Indent:Hanging: 0.5", Bulleted + Level: 1 + Alignedat: 0.25" + Indent at: 0.5"

Formatted: Left